ISIS Secret Cyber Terrorism Forum Exposed

The forum reflects ISIS hackers' growing desire to wage war online

Hundreds of Islamic State supporters have flocked to an online channel dedicated to providing tools needed to wage campaigns of cyber terror across the Internet.

More than 300 people now belong to an IS-affiliated forum filled with users swapping material on how to target and hack into vulnerable networks and computer systems. Deep Web research firm Vocativ discovered the jihadi e-academy on Telegram, a social messaging app that ISIS supporters have used previously to share instructions on how to make explosive devices, hand grenades, suicide belts and Molotov cocktails.

“This channel is dedicated to publishing courses of hacking and programming languages for the supporters of the Caliphate on the Internet,” reads the forum, which was formed on Nov. 24—less than two weeks after ISIS militants waged an orchestrated massacre in the streets of Paris.

Cyber security experts who reviewed some of the hacker material shared on Telegram said that it doesn’t provide the type of know-how required to carry out the kind of catastrophic cyber attack that many of these experts say is possible. The experts also conceded, however, that it reflects the group’s budding desire to wage increasingly sophisticated warfare online.

“Can they do damage? Sure,” said Herb Lin, a Senior Research Scholar for Cyber Policy and Security at Stanford University. “Can they do the kind of damage that causes all of the lights to go out in New York City? That’s much more difficult to discern.”

The bulk of material published on the ISIS hacker forum consisted of videos and content offered for free elsewhere online. Users, for example, recently shared a free, 27-part course on penetration testing, a practice that involves testing a computer system or network for vulnerabilities that a hacker can exploit.

Nearly all of the tutorials reviewed by Vocativ focused on similar skill sets. Experts said they alone are not enough to do serious damage. “Once you get inside a system you need to know what to do,” said Lars Hilse, a digital strategy consultant who authored a report on cyber terrorism last year. “That requires a certain degree of cleverness that, by itself, presents a hurdle to most people.”

The track record among hackers who claim to be affiliated with ISIS has not displayed that level of proficiency. ISIS supporters failed to follow through on threats they made to infiltrate US security on the anniversary of 9/11 this year and an attempt this month to dox US Senate Minority Leader Harry Reid relied on publicly available information, much of which was outdated or inaccurate, Vocativ found.
    
One of the more celebrated cyber attacks claimed by ISIS came in January when members of its so-called “Cyber Caliphate” managed to hack into US Central Command’s Twitter account. No actual Pentagon network or internal system was breached.

Such achievements are a far cry from any ability to cripple entire financial, military and communication systems, which analysts claim is feasible. And they pale in comparison to some of the recent cyber attacks conducted against the US by hackers based in China and Iran, who have managed to breach government data and gain access to American utility networks.

Yet to dismiss the desire among ISIS supporters to commit “cyber jihad” would be wrongheaded, said Alan Brill, a senior managing director at Kroll, a security consulting firm. Brill and other experts have warned for years that networks containing access to critical information and infrastructure are vulnerable. With a group as well-funded, well-organized and as committed to terror as ISIS on the scene, that’s enough to sound the alarm bells.

“If you just think about the interplay of rising hacker skills on the part of terrorists like ISIS and poor security it leads to the conclusion that there’s a significant amount of risk,” Brill told Vocativ. “To be honest, it scares me.”

Hilse said his own fears were realized in April when a group of hackers brought down a television network in France and infiltrated its website and Facebook page. The hackers claimed allegiance to the Islamic State. If it is proven that ISIS was behind the attack, it would signify a new level of sophistication for the terror group, albeit one that it has not demonstrated since.

“It would mean that ISIS is capable of breaching the cyber-physical threshold and actually getting into the real world,” Hilse said. While he’s cautious about giving credit to ISIS, it still remains a wakeup call.
“I know what the possibilities are if the dots are connected,” he said. “The damage can be potentially dire to our Western way of life.”

Vocativ: http://voc.tv/1VB6ilh

« Biggest Cybersecurity Threats In 2016
Google Chief Says UK Leads In E-commerce »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Norwegian Business & Industry Security Council (NSR)

Norwegian Business & Industry Security Council (NSR)

NSR is a member organization serving the Norwegian business sector in an advisory capacity on matters relating to crime and security including cyber.

Telelogos

Telelogos

Telelogos is a European provider of Enterprise Mobility Management software, Digital Signage software and Data Transfer and Synchronization software.

DANAK

DANAK

DANAK is the national accreditation body for Denmark. The directory of members provides details of organisations offering certification services for ISO 27001.

Project Moore

Project Moore

Project Moore is an Amsterdam law firm specialising in IT-law and privacy.

Granted Consultancy

Granted Consultancy

Granted Consultancy is a business consultancy that specialises in securing funding to support companies with the development and commercialisation of new and innovative products and technologies.

Brimondo

Brimondo

At Brimondo we help you to maximize and protect your brand value by being a proactive and strategic partner within brand protection with experts within intellectual property and digital assets.

Cytellix

Cytellix

Cytellix is an industry-standards-based, managed cybersecurity service provider, specializing in proactive behavioral analytics and situational awareness of an organization’s cyber posture.

NETRIO

NETRIO

If you are looking for a highly mature, exceptionally competent Managed Service Provider, NETRIO has solutions to keep your business running at warp speed with zero disruptions.

BigPanda

BigPanda

BigPanda is the first provider of Autonomous Operations solutions that empower IT Operations at large, complex enterprises.

MCPc

MCPc

MCPc improves the security and well-being of our clients. We protect data, manage the complexity and sustainability of technology, empower employee performance, and ultimately reduce business risk.

JFrog

JFrog

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime.

Crayon

Crayon

Crayon is a customer-centric innovation and IT services company. We provide guidance on the best solutions for our clients’ business needs and budget with software, cloud, AI and big data.

ProArch

ProArch

ProArch is a global team of multidisciplinary experts in cloud, infrastructure, data analytics, cybersecurity, compliance, and software development.

Exium

Exium

At Exium we’ve integrated networking and security in a cloud-delivered Zero Trust platform powered by 5G and open source.

Systems Engineering

Systems Engineering

Systems Engineering is a SOC 2, Type 2-certified IT strategy and managed technology services provider.

RELIANOID

RELIANOID

RELIANOID is an application delivery controller and load balancing system that ensures high performance and security of IT services on a massive scale.